recipe-plan
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (Design Documents and PRDs) and interpolates this content into prompts for subagents like
work-planneranddocument-reviewer. This creates a surface for indirect prompt injection attacks where a malicious document could influence agent behavior. - Ingestion points: Content is read from
$ARGUMENTSor files located indocs/design/and PRD paths. - Boundary markers: The skill uses mechanical extraction for prompt building but lacks explicit delimiters or instructions for the agent to ignore embedded commands within the source documents.
- Capability inventory: The skill facilitates the generation of work plans and test skeletons via tool calls to specialized subagents. It does not perform direct shell execution or network operations.
- Sanitization: There is no evidence of content sanitization or validation for the ingested documents.
Audit Metadata